import {
  ArrayMaxSize,
  IsArray,
  IsEnum,
  IsInt,
  IsOptional,
  IsString,
  Max,
  MaxLength,
  Min,
} from 'class-validator'

// Customer-editable security policy. Stored intent; enforcement is wired
// incrementally. Narrow — never touches plan/status/partner.
export class UpdateSecurityPolicyDto {
  @IsOptional() @IsEnum(['all', 'admins', 'optional'])
  mfaMode?: 'all' | 'admins' | 'optional'

  @IsOptional() @IsInt() @Min(0) @Max(1440)
  sessionIdleMinutes?: number

  @IsOptional() @IsInt() @Min(0) @Max(8760)
  sessionAbsoluteHours?: number

  // ISO alpha-2 country codes (uppercase). Empty array clears the allow-list.
  @IsOptional() @IsArray() @ArrayMaxSize(250) @IsString({ each: true }) @MaxLength(2, { each: true })
  allowedCountries?: string[]

  // CIDR / IP strings. Lightly validated as strings; format-checked at the
  // enforcement layer when geo/IP wiring lands.
  @IsOptional() @IsArray() @ArrayMaxSize(200) @IsString({ each: true }) @MaxLength(64, { each: true })
  ipAllowlist?: string[]
}
